WSO2 IS 5.9.0：如何通过嵌入式只读LDAP访问JDBC用户存储？

Alright, let's tackle this problem. You've got WSO2 Identity Server (IS) set up with a PostgreSQL JDBC user store, SCIM user provisioning, and OAuth2 for microservices, but now you're stuck integrating WSO2's embedded read-only LDAP with Camunda—since that LDAP doesn't contain the users from your JDBC store. Here are four actionable solutions, ordered by practicality and alignment with modern identity practices:

方案1：使用WSO2-IS作为Camunda的OIDC身份提供者（推荐） #

This approach lets you leverage WSO2's full authentication capabilities, avoids direct database/LDAP connections from Camunda, and naturally gives you access to all users in the JDBC store.

• Step 1: Configure a Service Provider in WSO2-IS

  1. Log into your WSO2-IS management console, go to Service Providers > Add, and name your Camunda service provider.
  2. Enable OAuth2/OpenID Connect Configuration, then add Camunda's callback URL (e.g., http://<camunda-host>:<port>/camunda/app/welcome/default/login/callback).
  3. Save the configuration and note down the generated Client ID and Client Secret.

• Step 2: Configure Camunda for OIDC Authentication
  If you're running Camunda on Spring Boot, add these settings to your application.properties:

  # OIDC Client Registration
  spring.security.oauth2.client.registration.wso2.client-id=<your-client-id>
  spring.security.oauth2.client.registration.wso2.client-secret=<your-client-secret>
  spring.security.oauth2.client.registration.wso2.scope=openid,profile,email
  spring.security.oauth2.client.registration.wso2.redirect-uri={baseUrl}/login/oauth2/code/wso2
  spring.security.oauth2.client.registration.wso2.provider=wso2
  
  # WSO2 OIDC Provider Metadata
  spring.security.oauth2.client.provider.wso2.authorization-uri=https://<wso2-host>:<port>/oauth2/authorize
  spring.security.oauth2.client.provider.wso2.token-uri=https://<wso2-host>:<port>/oauth2/token
  spring.security.oauth2.client.provider.wso2.user-info-uri=https://<wso2-host>:<port>/oauth2/userinfo
  spring.security.oauth2.client.provider.wso2.jwk-set-uri=https://<wso2-host>:<port>/oauth2/jwks
  

• Step 3: Map WSO2 User Data to Camunda
  Create a custom OidcUserService (or use Spring Security's default mapping) to map the user claims returned by WSO2 (like sub or username) to Camunda's identity model. You can also sync group memberships from WSO2 to Camunda if needed.

方案2：直接让Camunda连接WSO2的PostgreSQL JDBC用户存储 #

If you prefer a direct database connection, you can configure Camunda to read users directly from the same PostgreSQL database used by WSO2-IS.

• Step 1: Configure Camunda's JDBC Identity Provider
  Add these settings to your Camunda application.properties (or standalone.xml for Tomcat deployments):

  camunda.bpm.identity.provider=jdbc
  camunda.bpm.identity.jdbc.url=jdbc:postgresql://<db-host>:<port>/<wso2-db-name>
  camunda.bpm.identity.jdbc.driver-class=org.postgresql.Driver
  camunda.bpm.identity.jdbc.username=<db-user-with-read-access>
  camunda.bpm.identity.jdbc.password=<db-password>
  
  # Query statements matching WSO2's user store table structure
  camunda.bpm.identity.jdbc.user.select=SELECT USER_NAME, PASSWORD FROM UM_USER WHERE USER_NAME = ?
  camunda.bpm.identity.jdbc.user.list=SELECT USER_NAME FROM UM_USER
  camunda.bpm.identity.jdbc.group.select=SELECT GROUP_NAME FROM UM_GROUP WHERE GROUP_NAME = ?
  camunda.bpm.identity.jdbc.group.list=SELECT GROUP_NAME FROM UM_GROUP
  camunda.bpm.identity.jdbc.user-membership.select=SELECT GROUP_NAME FROM UM_USER_GROUP WHERE USER_NAME = ?
  

• Step 2: Handle Password Encryption Compatibility
  WSO2 uses SHA-256 (with salt) by default for password hashing. You'll need to configure Camunda to use a matching encoder:

  camunda.bpm.identity.password-policy.encoder=org.camunda.bpm.engine.impl.digest.Sha256PasswordEncoder
  # If WSO2 uses a custom salt format, you may need to implement a custom password encoder
  

方案3：Sync JDBC Users to WSO2's Embedded LDAP #

Since your embedded LDAP is read-only, you'll first need to temporarily make it writable, then set up a user sync job in WSO2-IS to copy users from the JDBC store to LDAP.

• Step 1: Make Embedded LDAP Writable
  Edit WSO2-IS's repository/conf/user-mgt.xml, find the embedded LDAP user store configuration, and change ReadOnly to false:

  <UserStoreManager class="org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager">
      <Property name="ReadOnly">false</Property>
      <!-- Keep other properties as-is -->
  </UserStoreManager>
  

  Restart WSO2-IS after making this change.

• Step 2: Set Up User Synchronization

  1. In the WSO2-IS console, go to Identity > User Management > User Synchronization.
  2. Create a new sync task:
     • Source User Store: Select your PostgreSQL JDBC user store
     • Target User Store: Select the embedded LDAP
     • Configure sync frequency (one-time or recurring) and user filters as needed.
  3. Run the sync task to copy all JDBC users to the LDAP.

• Step 3: Revert LDAP to Read-Only
  After sync completes, set ReadOnly back to true in user-mgt.xml and restart WSO2-IS. Now Camunda can connect to the embedded LDAP and see all synced users.

方案4：Configure WSO2-IS as an LDAP Proxy for Virtual User Stores #

WSO2-IS supports virtual user stores, which let you combine multiple user stores (JDBC + LDAP) into a single logical store. You can then expose this virtual store via WSO2's built-in LDAP server, so Camunda connects to WSO2's LDAP endpoint instead of the embedded LDAP directly.

• Step 1: Set Up a Virtual User Store
  Edit user-mgt.xml to replace the default user store with a virtual one:

  <UserStoreManager class="org.wso2.carbon.user.core.virtual.VirtualUserStoreManager">
      <Property name="SecondaryUserStores">JDBCStore,EmbeddedLDAP</Property>
      <Property name="DefaultUserStore">JDBCStore</Property>
      <!-- Add other required properties like ConnectionURL if needed -->
  </UserStoreManager>
  

  Replace JDBCStore with the name of your PostgreSQL user store, and EmbeddedLDAP with the name of your embedded LDAP store.

• Step 2: Enable WSO2's LDAP Server
  Ensure WSO2's LDAP server is enabled (it's on by default). The default LDAP port is 10389.

• Step 3: Configure Camunda to Connect to WSO2's LDAP Server
  Set up Camunda's LDAP identity provider pointing to WSO2's LDAP endpoint (e.g., ldap://<wso2-host>:10389), using credentials that have access to the virtual user store. This way, Camunda will see users from both the JDBC and embedded LDAP stores.

内容的提问来源于stack exchange，提问作者Pyla Srenu